@mikeargento/bitgraph 1.1.0 → 1.2.0

package/dist/fuse.js

@@ -0,0 +1,273 @@
+// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
+/**
+ * fuse(builder, options): the producer interface of the bitgraph-fuse/1
+ * profile (working name; outwardly this is simply BitGraph).
+ *
+ * The four beats, in order, with nothing else in between:
+ *   1. nonce:  allocate a slot; the enclave signs a record that contains no
+ *              artifact data and hands back a nonce that is a bearer ticket
+ *              until it is consumed.
+ *   2. fuse:   hand the COMMITMENT to that record (never the raw nonce) to the
+ *              builder, which writes it into the artifact it is producing and
+ *              returns the finished bytes.
+ *   3. hash:   SHA-256 of the fused bytes.
+ *   4. fill:   commit that digest under the same slot, with the placement id
+ *              and the origin digest in the signed attribution.
+ *
+ * What this module never does: write the nonce anywhere but process memory,
+ * put it in a message, or fall back to an ordinary recording when the fused
+ * commit fails. A failure is reported as a failure and the slot expires on
+ * its own.
+ *
+ * Transport: the site's proxy routes by default (POST /api/fuse/allocate and
+ * /api/fuse/commit, behind the anchor-first gate), configurable so a licensee
+ * can point it at a parent directly.
+ */
+import { sha256 } from "@noble/hashes/sha256";
+import { buildFrame, bytesToBase64, bytesToHex, computeSlotCommitment, computeSlotRecordHash, fuseAttribution, getPlacement, verifyFuse, base64ToBytes, } from "@mikeargento/bitgraph-verify";
+export class FuseError extends Error {
+    code;
+    status;
+    constructor(code, message, status = null) {
+        super(message);
+        this.name = "FuseError";
+        this.code = code;
+        this.status = status;
+    }
+}
+/** A builder for a registered placement over an existing original (Forms A and B), or for a bare Form C payload. */
+export function builderFor(placement, original) {
+    const p = getPlacement(placement);
+    if (p === undefined)
+        throw new FuseError("bad-placement", `placement "${placement}" is not registered`);
+    return ({ commitment, originDigest }) => {
+        if (original !== undefined)
+            return p.build({ original, originDigest: originDigest ?? sha256(original), commitment });
+        return p.build(originDigest !== undefined ? { originDigest, commitment } : { commitment });
+    };
+}
+const DEFAULTS = {
+    baseUrl: "https://bitgraph.ing",
+    allocatePath: "/api/fuse/allocate",
+    commitPath: "/api/fuse/commit",
+    lookupPath: "/api/proofs/",
+    timeoutMs: 30_000,
+    recoveryAttempts: 5,
+    recoveryDelayMs: 1_500,
+};
+const B64_32 = /^[A-Za-z0-9+/]{43}=$/;
+const B64_64 = /^[A-Za-z0-9+/]{86}==$/;
+function isSlotRecord(x) {
+    if (x === null || typeof x !== "object" || Array.isArray(x))
+        return false;
+    const s = x;
+    return (s.version === "bitgraph/slot/1" &&
+        typeof s.nonceB64 === "string" && B64_32.test(s.nonceB64) &&
+        typeof s.counter === "string" && /^(0|[1-9][0-9]*)$/.test(s.counter) &&
+        typeof s.epochId === "string" && typeof s.publicKeyB64 === "string" &&
+        typeof s.signatureB64 === "string" && B64_64.test(s.signatureB64));
+}
+function toUrlSafe(b64) {
+    return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function request(t, path, init) {
+    const f = t.fetch ?? fetch;
+    const headers = {};
+    if (init.body !== undefined)
+        headers["Content-Type"] = "application/json";
+    if (t.apiKey)
+        headers["Authorization"] = `Bearer ${t.apiKey}`;
+    let res;
+    try {
+        res = await f(`${t.baseUrl}${path}`, {
+            method: init.method,
+            headers,
+            ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+            signal: AbortSignal.timeout(t.timeoutMs),
+        });
+    }
+    catch (err) {
+        throw new FuseError("network", `request failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const text = await res.text();
+    let json = null;
+    try {
+        json = text.length > 0 ? JSON.parse(text) : null;
+    }
+    catch {
+        json = text;
+    }
+    return { status: res.status, json, headers: res.headers };
+}
+function messageOf(json, fallback) {
+    return json !== null && typeof json === "object" && typeof json.error === "string" ? json.error : fallback;
+}
+function codeOf(json) {
+    return json !== null && typeof json === "object" && typeof json.code === "string" ? json.code : null;
+}
+/**
+ * Read the proof back by digest after a lost or refused commit: the ONE proof
+ * whose commit.slotHashB64 is the hash of the slot record we hold. Any other
+ * proof of the same digest is a different recording under a different slot.
+ * Never allocates.
+ */
+async function recover(t, artifactDigestB64, slot) {
+    const expectedSlotHash = bytesToBase64(computeSlotRecordHash(slot));
+    for (let attempt = 0; attempt < t.recoveryAttempts; attempt++) {
+        if (attempt > 0)
+            await sleep(t.recoveryDelayMs);
+        let r;
+        try {
+            r = await request(t, `${t.lookupPath}${encodeURIComponent(toUrlSafe(artifactDigestB64))}`, { method: "GET" });
+        }
+        catch {
+            continue;
+        }
+        if (r.status !== 200)
+            continue;
+        const proofs = r.json?.proofs;
+        if (!Array.isArray(proofs))
+            continue;
+        for (const entry of proofs) {
+            const p = entry?.proof;
+            if (p && p.commit?.slotHashB64 === expectedSlotHash && p.commit?.nonceB64 === slot.nonceB64)
+                return p;
+        }
+    }
+    return null;
+}
+/**
+ * Allocate, fuse, hash, fill. Returns the Frame with the unchanged proof, or
+ * throws a FuseError; it never returns an ordinary recording in place of a
+ * fused one.
+ */
+export async function fuse(builder, options) {
+    const placement = getPlacement(options.placement);
+    if (placement === undefined)
+        throw new FuseError("bad-placement", `placement "${options.placement}" is not registered`);
+    if (placement.form !== "C" && options.original === undefined)
+        throw new FuseError("bad-input", `${placement.id} needs the original bytes`);
+    if (placement.form === "C" && options.original !== undefined)
+        throw new FuseError("bad-input", "produced/1 takes no original; pass originDigest to name a source");
+    if (options.originDigest !== undefined && options.originDigest.length !== 32)
+        throw new FuseError("bad-input", "originDigest must be 32 bytes");
+    const t = { ...DEFAULTS, ...(options.transport ?? {}) };
+    const originDigest = options.original !== undefined ? sha256(options.original) : options.originDigest;
+    const originDigestB64 = originDigest !== undefined ? bytesToBase64(originDigest) : null;
+    // 1. nonce
+    const alloc = await request(t, t.allocatePath, { method: "POST", body: {} });
+    if (alloc.status === 503 && codeOf(alloc.json) === "tee-restarting")
+        throw new FuseError("tee-restarting", messageOf(alloc.json, "the boundary is restarting"), 503);
+    if (alloc.status !== 200)
+        throw new FuseError("allocate-failed", messageOf(alloc.json, `allocation failed (${alloc.status})`), alloc.status);
+    const slotId = alloc.json?.slotId;
+    const slot = alloc.json?.slot;
+    if (!isSlotRecord(slot) || slotId !== slot.nonceB64)
+        throw new FuseError("allocate-failed", "the allocation response is not a slot record", alloc.status);
+    if (slot.chainId !== "bitgraph:main")
+        throw new FuseError("allocate-failed", "the slot is not on the anchored chain; a fused floor needs bitgraph:main");
+    // 2. fuse
+    const commitment = computeSlotCommitment(slot);
+    let fused;
+    try {
+        fused = await builder({ commitment, commitmentHex: bytesToHex(commitment), ...(originDigest !== undefined ? { originDigest } : {}), slot });
+    }
+    catch (err) {
+        throw new FuseError("builder-failed", `the builder threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!(fused instanceof Uint8Array))
+        throw new FuseError("builder-failed", "the builder must return a Uint8Array");
+    // Fail closed: never commit bytes that do not carry the commitment.
+    const located = placement.locate(fused);
+    if (located === null || bytesToHex(located.commitment) !== bytesToHex(commitment)) {
+        throw new FuseError("commitment-missing", `the fused bytes do not carry the ${placement.id} commitment; nothing was committed and the slot will expire`);
+    }
+    // 3. hash
+    const artifactDigest = sha256(fused);
+    const artifactDigestB64 = bytesToBase64(artifactDigest);
+    // 4. fill
+    const attribution = fuseAttribution(placement.id, originDigest);
+    const body = {
+        digests: [{ digestB64: artifactDigestB64, hashAlg: "sha256" }],
+        slotId: slot.nonceB64,
+        slot,
+        chainId: "bitgraph:main",
+        attribution,
+    };
+    if (options.agency !== undefined)
+        body.agency = options.agency;
+    let proof = null;
+    let recovered = false;
+    let commit = null;
+    try {
+        commit = await request(t, t.commitPath, { method: "POST", body });
+    }
+    catch (err) {
+        // The request may have reached the boundary. Read back before giving up; never allocate again.
+        proof = await recover(t, artifactDigestB64, slot);
+        if (proof === null)
+            throw err;
+        recovered = true;
+    }
+    if (proof === null && commit !== null) {
+        if (commit.status === 200) {
+            const j = commit.json;
+            proof = Array.isArray(j) ? (j[0] ?? null) : (j?.proof ?? null);
+            if (proof === null)
+                throw new FuseError("commit-refused", "the commit response carried no proof", 200);
+        }
+        else if (commit.status === 409 && codeOf(commit.json) === "slot-unavailable") {
+            proof = await recover(t, artifactDigestB64, slot);
+            if (proof === null)
+                throw new FuseError("slot-unavailable", messageOf(commit.json, "the slot is no longer available"), 409);
+            recovered = true;
+        }
+        else if (commit.status === 503 && codeOf(commit.json) === "tee-restarting") {
+            proof = await recover(t, artifactDigestB64, slot);
+            if (proof === null)
+                throw new FuseError("tee-restarting", messageOf(commit.json, "the boundary is restarting"), 503);
+            recovered = true;
+        }
+        else {
+            throw new FuseError("commit-refused", messageOf(commit.json, `commit refused (${commit.status})`), commit.status);
+        }
+    }
+    if (proof === null)
+        throw new FuseError("transport", "no proof");
+    // Never label as fused a proof under any other slot.
+    if (proof.slotAllocation?.nonceB64 !== slot.nonceB64 || proof.commit?.nonceB64 !== slot.nonceB64) {
+        throw new FuseError("slot-mismatch", "the boundary returned a proof under a different slot; nothing is labelled fused");
+    }
+    // A minted proof is verified by a reader before it is called a proof.
+    const verification = await verifyFuse({ proof, bytes: fused });
+    if (verification.category !== "FUSED_DIRECT") {
+        throw new FuseError("verification-failed", `the returned proof does not verify as fused: ${verification.category}${verification.reason ? ` (${verification.reason})` : ""}`);
+    }
+    const frame = buildFrame({
+        proof,
+        placement: placement.id,
+        artifactDigest,
+        ...(originDigest !== undefined ? { originDigest } : {}),
+        fusedFile: options.fusedFile ?? null,
+        ...(placement.form === "C" ? { fusePayload: fused } : {}),
+    });
+    const keep = options.keepFused ?? !placement.byteExact;
+    return {
+        frame,
+        proof,
+        artifactDigestB64,
+        originDigestB64,
+        ...(keep ? { fusedBytes: fused } : {}),
+        recovered,
+        verification,
+    };
+}
+/** Decode a standard-base64 digest, for callers holding one as text. */
+export function digestFromBase64(b64) {
+    const d = base64ToBytes(b64);
+    if (d === null || d.length !== 32)
+        throw new FuseError("bad-input", "not a 32-byte base64 digest");
+    return d;
+}
+//# sourceMappingURL=fuse.js.map

package/dist/fuse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fuse.js","sourceRoot":"","sources":["../src/fuse.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,UAAU,EACV,aAAa,EACb,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,8BAA8B,CAAC;AAgFtC,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAgB;IACpB,MAAM,CAAgB;IAC/B,YAAY,IAAmB,EAAE,OAAe,EAAE,SAAwB,IAAI;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,oHAAoH;AACpH,MAAM,UAAU,UAAU,CAAC,SAAsB,EAAE,QAAqB;IACtE,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,cAAc,SAAS,qBAAqB,CAAC,CAAC;IACxG,OAAO,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,EAAE;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,sBAAsB;IAC/B,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAC9B,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,MAAM;IACjB,gBAAgB,EAAE,CAAC;IACnB,eAAe,EAAE,KAAK;CACd,CAAC;AAEX,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAEvC,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,CAAC,CAAC,OAAO,KAAK,iBAAiB;QAC/B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzD,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QACpE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QACnE,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpE,KAAK,UAAU,OAAO,CACpB,CAAyE,EACzE,IAAY,EACZ,IAAgD;IAEhD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;IAC3B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAC1E,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO;YACP,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,SAAS,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC;IAAC,CAAC;IAChF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,QAAgB;IAChD,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA4B,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,IAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7J,CAAC;AAED,SAAS,MAAM,CAAC,IAAa;IAC3B,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA2B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACrJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CACpB,CAAiI,EACjI,iBAAyB,EACzB,IAAoB;IAEpB,MAAM,gBAAgB,GAAG,aAAa,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,CAAoC,CAAC;QACzC,IAAI,CAAC;YACH,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,SAAS;QAC/B,MAAM,MAAM,GAAI,CAAC,CAAC,IAA6D,EAAE,MAAM,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,KAAK,gBAAgB,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAAE,OAAO,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB,EAAE,OAAoB;IACnE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,cAAc,OAAO,CAAC,SAAS,qBAAqB,CAAC,CAAC;IACxH,IAAI,SAAS,CAAC,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAC3I,IAAI,SAAS,CAAC,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,kEAAkE,CAAC,CAAC;IACnK,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;IAEhJ,MAAM,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACtG,MAAM,eAAe,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,WAAW;IACX,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,gBAAgB;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;IACrK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7I,MAAM,MAAM,GAAI,KAAK,CAAC,IAAoC,EAAE,MAAM,CAAC;IACnE,MAAM,IAAI,GAAI,KAAK,CAAC,IAAkC,EAAE,IAAI,CAAC;IAC7D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,8CAA8C,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1J,IAAI,IAAI,CAAC,OAAO,KAAK,eAAe;QAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,0EAA0E,CAAC,CAAC;IAEzJ,UAAU;IACV,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9I,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;IAClH,oEAAoE;IACpE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,oCAAoC,SAAS,CAAC,EAAE,6DAA6D,CAAC,CAAC;IAC3J,CAAC;IAED,UAAU;IACV,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,iBAAiB,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAExD,UAAU;IACV,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAChE,MAAM,IAAI,GAA4B;QACpC,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC9D,MAAM,EAAE,IAAI,CAAC,QAAQ;QACrB,IAAI;QACJ,OAAO,EAAE,eAAe;QACxB,WAAW;KACZ,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE/D,IAAI,KAAK,GAAyB,IAAI,CAAC;IACvC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,MAAM,GAA6C,IAAI,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+FAA+F;QAC/F,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,GAAG,CAAC;QAC9B,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,IAA0D,CAAC;YAC5E,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;YAC/D,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAC;QACzG,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAC/E,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5H,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAC7E,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;YACrH,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAEjE,qDAAqD;IACrD,IAAI,KAAK,CAAC,cAAc,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjG,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,iFAAiF,CAAC,CAAC;IAC1H,CAAC;IACD,sEAAsE;IACtE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,IAAI,YAAY,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,gDAAgD,YAAY,CAAC,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/K,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,KAAK;QACL,SAAS,EAAE,SAAS,CAAC,EAAE;QACvB,cAAc;QACd,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;IACvD,OAAO;QACL,KAAK;QACL,KAAK;QACL,iBAAiB;QACjB,eAAe;QACf,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/index.d.ts

@@ -15,6 +15,8 @@ export { computeProofHash } from "@mikeargento/bitgraph-verify";
 export { canonicalize, canonicalizeToString, constantTimeEqual } from "@mikeargento/bitgraph-verify";
 export type { HostCapabilities } from "./host.js";
 export { Constructor } from "./constructor.js";
+export { fuse, builderFor, FuseError, digestFromBase64 } from "./fuse.js";
+export type { FuseBuilder, BuilderInput, FuseOptions, FuseResult, FuseTransport, FuseErrorCode } from "./fuse.js";
 export { parsePolicy, hashPolicy, createPolicyBinding, validateAction, } from "./policy.js";
 export type { PolicyDocument, PolicyRules, ActionValidationResult, } from "./policy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAGH,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAGrG,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,EACL,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,cAAc,EACd,WAAW,EACX,sBAAsB,GACvB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAGH,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAGrG,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAK/C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1E,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGlH,OAAO,EACL,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,cAAc,EACd,WAAW,EACX,sBAAsB,GACvB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -4,6 +4,10 @@ export { computeProofHash } from "@mikeargento/bitgraph-verify";
 export { canonicalize, canonicalizeToString, constantTimeEqual } from "@mikeargento/bitgraph-verify";
 // Constructor (write path)
 export { Constructor } from "./constructor.js";
+// The producer profile over the primitive (working name Fuse): allocate a
+// slot, write a commitment to it into the artifact, hash, commit under the
+// same slot. The resulting proof is ordinary bitgraph/1.
+export { fuse, builderFor, FuseError, digestFromBase64 } from "./fuse.js";
 // Policy parsing, hashing, and validation
 export { parsePolicy, hashPolicy, createPolicyBinding, validateAction, } from "./policy.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AA4BhE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAKrG,2BAA2B;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,0CAA0C;AAC1C,OAAO,EACL,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AA4BhE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAKrG,2BAA2B;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,0EAA0E;AAC1E,2EAA2E;AAC3E,yDAAyD;AACzD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG1E,0CAA0C;AAC1C,OAAO,EACL,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikeargento/bitgraph",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Portable cryptographic proof of construction for digital artifacts.",
   "type": "module",
@@ -17,24 +17,34 @@
     "src",
     "README.md",
     "LICENSE",
-    "NOTICE"
+    "NOTICE",
+    "!src/__tests__/fuse-fixtures"
   ],
   "scripts": {
-    "build": "tsc",
-    "typecheck": "tsc --noEmit",
-    "test:core": "tsc && node --test dist/__tests__/canonical.test.js dist/__tests__/constructor.test.js dist/__tests__/verifier.test.js",
-    "test": "npm run test:core"
+    "build": "npm run build --workspace=packages/verify && npm run build --workspace=packages/audit && npm run build --workspace=packages/player && npm run build --workspace=packages/mcp && tsc",
+    "typecheck": "npm run build --workspace=packages/verify && npm run build --workspace=packages/audit && npm run typecheck --workspace=packages/mcp && tsc --noEmit",
+    "test:core": "npm run build && node --test dist/__tests__/canonical.test.js dist/__tests__/constructor.test.js dist/__tests__/verifier.test.js dist/__tests__/proof-integrity.test.js dist/__tests__/audit-ingest.test.js dist/__tests__/audit-tiers.test.js dist/__tests__/audit-reconstruct.test.js dist/__tests__/audit-anomalies.test.js dist/__tests__/audit-anchors.test.js dist/__tests__/audit-witness.test.js dist/__tests__/audit-temporal.test.js dist/__tests__/audit-attestation.test.js dist/__tests__/audit-report.test.js dist/__tests__/audit-cli.test.js dist/__tests__/audit-property.test.js dist/__tests__/audit-real-fixtures.test.js dist/__tests__/audit-dependencies.test.js dist/__tests__/audit-bench-smoke.test.js dist/__tests__/audit-roundtrip.test.js dist/__tests__/audit-real-live.test.js dist/__tests__/chain-hash-anchor.test.js dist/__tests__/audit-boundary.test.js dist/__tests__/audit-witness-real.test.js dist/__tests__/audit-memory-ingest.test.js dist/__tests__/fuse-vectors.test.js dist/__tests__/fuse-roundtrip.test.js dist/__tests__/fuse-verify.test.js dist/__tests__/fuse-sdk.test.js",
+    "test": "npm run test:core",
+    "prepack": "npm run build"
   },
   "dependencies": {
-    "@mikeargento/bitgraph-verify": "^1.0.0",
+    "@mikeargento/bitgraph-verify": "^1.4.0",
     "@noble/ed25519": "^2.1.0",
     "@noble/hashes": "^1.4.0"
   },
   "devDependencies": {
+    "@mikeargento/bitgraph-audit": "^0.4.0",
     "@types/node": "^20.0.0",
     "typescript": "^5.4.0"
   },
   "workspaces": [
-    "packages/verify"
-  ]
+    "packages/verify",
+    "packages/audit",
+    "packages/mcp",
+    "packages/player",
+    "packages/titles"
+  ],
+  "bin": {
+    "bitgraph-fuse": "./dist/fuse-cli.js"
+  }
 }

package/src/__tests__/audit-anchors.test.ts

@@ -0,0 +1,188 @@
+// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
+
+/**
+ * Anchor identification tests (G5): the SIGNED attribution.name is the
+ * discriminator; unsigned metadata.type is corroboration only, recorded
+ * but never trusted; the block number comes only from the signed
+ * Etherscan URL; no wall-clock time is ever derived from anything here.
+ */
+
+import { describe, it } from "node:test";
+import * as assert from "node:assert/strict";
+import {
+  identifyAnchors,
+  ingestBundle,
+  verifyObservedProofs,
+} from "@mikeargento/bitgraph-audit";
+import type { IngestResult } from "@mikeargento/bitgraph-audit";
+import {
+  makeAnchorProof,
+  makeChainIdProof,
+  makeTempDir,
+  proofJson,
+  writeBundleDir,
+} from "./audit-fixtures.js";
+
+const BLOCK_HASH = "0x28ed3639cd705fb8cb2b915c1991e9f808b40e775bc8eb540702942729fec2c0";
+
+async function ingestAndVerify(files: Record<string, string | Uint8Array>): Promise<IngestResult> {
+  const dir = await makeTempDir("bg-audit-anchors-");
+  await writeBundleDir(dir, files);
+  const ingest = await ingestBundle(dir);
+  await verifyObservedProofs(ingest);
+  return ingest;
+}
+
+describe("audit anchors: identification by signed attribution", () => {
+  it("identifies an anchor by attribution.name and extracts the signed facts", async () => {
+    const anchor = await makeAnchorProof({
+      blockHash: BLOCK_HASH,
+      blockNumber: "24800448",
+      epochId: "EPOCH-A",
+      counter: "4",
+      slotCounter: "3",
+      chainId: "bitgraph:main",
+      metadata: {
+        type: "ethereum-anchor",
+        anchor: { blockNumber: 24800448, blockHash: BLOCK_HASH, blockTime: 1750000000 },
+      },
+    });
+    const user = await makeChainIdProof({ chainId: "bitgraph:main", counter: "6", epochId: "EPOCH-A" });
+
+    const ingest = await ingestAndVerify({
+      "proofs/anchor.json": proofJson(anchor.proof),
+      "proofs/user.json": proofJson(user.proof),
+    });
+    const result = identifyAnchors(ingest);
+
+    assert.equal(result.anchors.length, 1);
+    const record = result.anchors[0]!;
+    assert.equal(record.proofHash, anchor.proofHash);
+    assert.equal(record.epochId, "EPOCH-A");
+    assert.equal(record.chainId, "bitgraph:main");
+    assert.equal(record.counter, "4");
+    assert.equal(record.slotCounter, "3");
+    assert.equal(record.blockHash, BLOCK_HASH);
+    assert.equal(record.blockNumber, "24800448");
+    assert.equal(record.metadataCorroboration, "agrees");
+    // The unsigned metadata carries a blockTime; no time field of any kind
+    // may appear on the record.
+    assert.ok(!("timestamp" in record));
+    assert.ok(!("blockTime" in record));
+    assert.equal(result.findings.length, 0);
+  });
+
+  it("copies the run verification status onto the record", async () => {
+    const good = await makeAnchorProof({ blockHash: BLOCK_HASH, blockNumber: "1", epochId: "E", counter: "2" });
+    const bad = await makeAnchorProof({ blockHash: BLOCK_HASH.replace("28", "29"), blockNumber: "2", epochId: "E", counter: "4" });
+    // Tamper the signature after signing: identification still works (it
+    // reads the signed body fields), and the failed status is copied.
+    bad.proof.signer.signatureB64 = `AA${bad.proof.signer.signatureB64.slice(2)}`;
+
+    const ingest = await ingestAndVerify({
+      "proofs/good.json": proofJson(good.proof),
+      "proofs/bad.json": proofJson(bad.proof),
+    });
+    const result = identifyAnchors(ingest);
+
+    assert.equal(result.anchors.length, 2);
+    const goodRecord = result.anchors.find((a) => a.proofHash === good.proofHash)!;
+    assert.equal(goodRecord.verificationTier, "integrity");
+    assert.equal(goodRecord.verificationStatus, "artifact-unavailable");
+    const badRecord = result.anchors.find((a) => a.proofHash !== good.proofHash)!;
+    assert.equal(badRecord.verificationStatus, "failed");
+    assert.ok(badRecord.verificationReason !== undefined);
+  });
+
+  it("never identifies an anchor from unsigned metadata alone", async () => {
+    const user = await makeChainIdProof({ counter: "2", epochId: "E-META" });
+    (user.proof as unknown as Record<string, unknown>)["metadata"] = { type: "ethereum-anchor" };
+
+    const ingest = await ingestAndVerify({ "proofs/claimant.json": proofJson(user.proof) });
+    const result = identifyAnchors(ingest);
+
+    assert.equal(result.anchors.length, 0);
+    assert.equal(result.metadataOnlyProofHashes.length, 1);
+    const finding = result.findings.find((f) => f.code === "anchor-metadata-only-claim");
+    assert.ok(finding !== undefined);
+    assert.match(finding.message, /not treated as an anchor/);
+  });
+
+  it("records disagreement between the signed attribution and unsigned metadata", async () => {
+    const anchor = await makeAnchorProof({
+      blockHash: BLOCK_HASH,
+      blockNumber: "7",
+      epochId: "E-DIS",
+      counter: "2",
+      metadata: { type: "something-else" },
+    });
+    const ingest = await ingestAndVerify({ "proofs/anchor.json": proofJson(anchor.proof) });
+    const result = identifyAnchors(ingest);
+
+    assert.equal(result.anchors.length, 1, "the signed field governs: still an anchor");
+    assert.equal(result.anchors[0]!.metadataCorroboration, "disagrees");
+    assert.ok(result.findings.some((f) => f.code === "anchor-metadata-disagreement"));
+  });
+
+  it("treats absent metadata as absent corroboration, not disagreement", async () => {
+    const anchor = await makeAnchorProof({ blockHash: BLOCK_HASH, blockNumber: "9", epochId: "E-ABS", counter: "2" });
+    const ingest = await ingestAndVerify({ "proofs/anchor.json": proofJson(anchor.proof) });
+    const result = identifyAnchors(ingest);
+    assert.equal(result.anchors[0]!.metadataCorroboration, "absent");
+    assert.equal(result.findings.filter((f) => f.code === "anchor-metadata-disagreement").length, 0);
+  });
+});
+
+describe("audit anchors: block number from the signed title URL", () => {
+  it("parses the number only from a strict Etherscan block URL", async () => {
+    const good = await makeAnchorProof({ blockHash: BLOCK_HASH, blockNumber: "24800448", epochId: "E-URL", counter: "2" });
+    const foreign = await makeAnchorProof({
+      blockHash: BLOCK_HASH.replace("28", "30"),
+      title: "https://example.com/block/99",
+      epochId: "E-URL",
+      counter: "4",
+    });
+    const missing = await makeAnchorProof({
+      blockHash: BLOCK_HASH.replace("28", "31"),
+      noTitle: true,
+      epochId: "E-URL",
+      counter: "6",
+    });
+
+    const ingest = await ingestAndVerify({
+      "proofs/good.json": proofJson(good.proof),
+      "proofs/foreign.json": proofJson(foreign.proof),
+      "proofs/missing.json": proofJson(missing.proof),
+    });
+    const result = identifyAnchors(ingest);
+
+    const byHash = new Map(result.anchors.map((a) => [a.proofHash, a]));
+    assert.equal(byHash.get(good.proofHash)!.blockNumber, "24800448");
+    assert.equal(byHash.get(foreign.proofHash)!.blockNumber, undefined);
+    assert.equal(byHash.get(missing.proofHash)!.blockNumber, undefined);
+    assert.equal(result.findings.filter((f) => f.code === "anchor-title-unparseable").length, 2);
+  });
+});
+
+describe("audit anchors: non-anchor proofs are untouched", () => {
+  it("produces no records or findings for ordinary proofs and mutates nothing", async () => {
+    const a = await makeChainIdProof({ counter: "2", epochId: "E-PLAIN" });
+    const b = await makeChainIdProof({ counter: "4", epochId: "E-PLAIN" });
+    const ingest = await ingestAndVerify({
+      "proofs/a.json": proofJson(a.proof),
+      "proofs/b.json": proofJson(b.proof),
+    });
+    const statusesBefore = ingest.proofs.map((p) => p.verification?.status);
+
+    const result = identifyAnchors(ingest);
+
+    assert.equal(result.anchors.length, 0);
+    assert.equal(result.metadataOnlyProofHashes.length, 0);
+    assert.equal(result.findings.length, 0);
+    assert.deepEqual(
+      ingest.proofs.map((p) => p.verification?.status),
+      statusesBefore,
+      "identification is read-only"
+    );
+  });
+});